Skip to content
OpenAdvisories
High RLSA-2022:0258 1 CVE

Important: httpd:2.4 security update

Published Jan 25, 2022 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
Rocky Linux · 8 httpd 0:2.4.37-39.module+el8.4.0+571+fd70afb1
Rocky Linux · 8 httpd 0:2.4.37-43.module+el8.5.0+714+5ec56ee8
Rocky Linux · 8 mod_http2 0:1.15.7-3.module+el8.4.0+553+7a69454b
Rocky Linux · 8 mod_http2 0:1.15.7-3.module+el8.5.0+695+1fa8055e
Rocky Linux · 8 mod_md 1:2.0.8-8.module+el8.5.0+695+1fa8055e
Rocky Linux · 8 mod_md 1:2.0.8-8.module+el8.4.0+553+7a69454b

Vulnerabilities 1

  • Unscored —
    CVE-2021-44790 Public exploit EPSS 97%

    Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

    A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue af…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034674